This is an automated email from the ASF dual-hosted git repository.
vernedeng pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/inlong-website.git
The following commit(s) were added to refs/heads/master by this push:
new 0241002f39f [INLONG-1191][Release] Add blog for the 2.4.0 release
(#1194)
0241002f39f is described below
commit 0241002f39f48b71aca9713442942288a983b2f3
Author: vernedeng <[email protected]>
AuthorDate: Thu Aug 20 17:29:41 2026 +0800
[INLONG-1191][Release] Add blog for the 2.4.0 release (#1194)
---
blog/2026-08-13-release-2.4.0.md | 119 +++++++++++++++++++
.../2026-08-13-release-2.4.0.md | 129 +++++++++++++++++++++
2 files changed, 248 insertions(+)
diff --git a/blog/2026-08-13-release-2.4.0.md b/blog/2026-08-13-release-2.4.0.md
new file mode 100644
index 00000000000..72a399baccc
--- /dev/null
+++ b/blog/2026-08-13-release-2.4.0.md
@@ -0,0 +1,119 @@
+---
+title: Version 2.4.0 Released
+author: vernedeng
+author_url: https://github.com/vernedeng
+author_image_url: https://avatars.githubusercontent.com/vernedeng
+tags: [Apache InLong, Version]
+---
+
+Apache InLong (应龙) recently released version 2.4.0, which resolved 58 issues,
including 10 new features and 45+ optimizations and bug fixes. This version
focuses on a comprehensive security hardening of the whole data integration
link, covering permission verification, SQL injection defense, command
execution and file path validation. It also extends the TransformSDK with
ProtoBuf and complex type processing capabilities, optimizes the DataProxy Go
SDK and the Python DataProxy SDK releas [...]
+<!--truncate-->
+
+## About Apache InLong
+
+As the industry's first one-stop, all-scenario massive data integration
framework, Apache InLong (Yinglong) delivers automated, secure, reliable, and
high-performance data transmission capabilities. It enables businesses to
rapidly build stream-based data analysis, modeling, and applications.
Currently, InLong is widely used across industries such as advertising,
payment, social media, gaming, and artificial intelligence, serving thousands
of business use cases. It handles over a million [...]
+
+The core positioning of InLong revolves around three keywords: "one-stop,"
"all-scenario," and "massive data." For "one-stop," InLong aims to shield
technical complexities by providing complete data integration and supporting
services for out-of-the-box usability. For "all-scenario," it offers
comprehensive solutions covering common data integration scenarios in big data
ecosystems. For "massive data," its architecture leverages data pipeline
layering, fully extensible components, and bu [...]
+
+## Overview of Version 2.4.0
+
+Apache InLong (应龙) recently released version 2.4.0, which resolved 58 issues,
including 10 new features and 45+ optimizations and bug fixes. Key enhancements
include:
+
+- **Security**: Comprehensive security hardening across Manager and Agent,
including permission verification, SQL injection defense, command whitelist
validation and file path validation
+- **SDK**: TransformSDK supports ProtoBuf description files with multiple
Proto files and multi-level nested types, and supports encoding of
List/Struct/Binary complex types
+- **SDK**: DataProxy Go SDK improves connection initialization, worker
selection and error diagnostics; the Python DataProxy SDK now builds standard
wheels based on PEP-517
+- **Audit**: Optimized audit route management and resolved thread-safety
issues in the Audit SDK under high concurrency
+
+This version also optimizes the operational and maintenance experience for
Apache InLong. Other significant features are detailed below.
+
+### Dashboard Module
+- Added the missing agent installation method on the agent page
+- Optimized text display for long forms on the resource details page,
improving readability
+
+### Manager Module
+- Enhanced verification against SQL injection, and fixed the security
vulnerabilities in the `/api/node/testConnection` and
`/api/cluster/testConnection` interfaces
+- Added command whitelist validation, and added permission verification for
streamsource deletion, datanode modification and tenant role
creation/modification
+- The default value of `openapi.auth.enabled` is now `true`, so OpenAPI
authentication is enabled out of the box
+- Added parameter validation for `AuditAlertRuleRequest` order fields and for
the node parameter in `clusterController`
+- Fixed the incorrect results returned by the LIKE matching operator when
querying MQ messages, and added proper error handling when the MQ message query
thread pool is exhausted
+- Improved the completeness of the audit query nodeType mapping to avoid null
audit IDs
+
+### Agent Module
+- Fixed the path traversal risk caused by an unvalidated file source path
+- Replaced `/bin/sh -c` with `ProcessBuilder` to avoid the risk of command
injection
+- Fixed the missing case in a switch statement
+
+### Sort Module
+- Sort Format supports outputting complete row information when field parsing
errors occur, making troubleshooting easier
+- Fixed the NPE thrown by `SortConfigUtil.checkUpdate` when
`DataFlowConfig.version` is null, which caused SortConfig reload to permanently
stall
+
+### SDK Module
+- TransformSDK supports decoding and transformation of ProtoBuf description
files with multiple Proto files and multi-level nested types, and supports
parsing map nodes
+- TransformSDK supports encoding of List, Struct and Binary type fields for
RowData, and adds the `concat_struct`/`extract_struct`/`extract_binary`
functions
+- TransformSDK supports the "not in" operator and SQL reserved keywords as
source field names (backtick-quoted columns)
+- Fixed the issue where `PbSourceData` returned protobuf default values
instead of null for unset fields, which caused incorrect data to be written to
Iceberg/Parquet sinks
+- DataProxy Go SDK adds a connection timeout and tolerates partial endpoint
failures during client initialization, optimizes the worker selection logic,
supports a retry mechanism on server errors, and logs the remote server address
on send timeouts and errors
+- Python DataProxy SDK builds standard wheels based on PEP-517, adds a compile
Dockerfile, and optimizes dependency version requirements
+
+### Audit Module
+- Optimized audit route management, and audit routing data source management
now supports domain names
+- Optimized the auditing data statistics by day, and the day-level API fills
with zero when there is no data
+- Resolved thread-safety issues in the Audit SDK under high concurrency
+- Fixed the ClassLoader leaks and shared state corruption caused by the static
`ScheduledExecutorService` in `PulsarSink`
+- Fixed the audit SQL script initialization failure
+
+### Common Module
+- Added JSON config support, and fixed the issue where jsonconfig could not be
serialized correctly
+
+### CI Module
+- Fixed the GitHub Action workflow policy violations, upgraded the actions
version and specified the permission of actions
+- Fixed the failure of all unit tests
+
+## Key Features of Version 2.4.0
+
+### Comprehensive security hardening of the data integration link
+Security is a core capability of a data integration framework. In this
version, the community carried out a systematic security review and hardening
of Manager and Agent, covering the most common attack surfaces of an open
management plane:
+
+- **Permission verification**: Operator permissions are now verified when
deleting a streamsource, modifying a datanode, and creating or modifying tenant
roles, preventing unauthorized operations on resources.
+- **SQL injection defense**: The verification against SQL injection is
enhanced, and the security vulnerabilities in the `/api/node/testConnection`
and `/api/cluster/testConnection` interfaces are fixed.
+- **Command execution**: A command whitelist validation is added in Manager,
and the Agent replaces `/bin/sh -c` with `ProcessBuilder`, eliminating the risk
of shell command injection.
+- **File path validation**: The Agent validates the file source path to
prevent path traversal.
+- **Secure defaults**: The default value of `openapi.auth.enabled` is changed
to `true`, so OpenAPI authentication is enabled by default rather than
requiring manual configuration.
+
+*Contributed by [@fuweng11](https://github.com/fuweng11) via
[INLONG-12129](https://github.com/apache/inlong/pull/12130),
[INLONG-12133](https://github.com/apache/inlong/pull/12134),
[INLONG-12135](https://github.com/apache/inlong/pull/12136),
[INLONG-12144](https://github.com/apache/inlong/pull/12145),
[INLONG-12156](https://github.com/apache/inlong/pull/12157),
[INLONG-12160](https://github.com/apache/inlong/pull/12161), and by
[@spiritxishi](https://github.com/spiritxishi) via [INLONG [...]
+
+### TransformSDK supports ProtoBuf and complex type processing
+InLong Transform adapts to complex and diverse data analysis scenarios on the
distribution side. In real-world business, ProtoBuf descriptions are usually
split into multiple Proto files and contain deeply nested structures, and the
target sinks often require complex types instead of flat columns. This version
substantially extends the expressive power of the TransformSDK:
+
+- Decoding and transformation of ProtoBuf description files with multiple
Proto files and multi-level nested types, and parsing of map nodes.
+- Encoding of List, Struct and Binary type fields for RowData, so that complex
types can be written to sinks such as Iceberg and Parquet directly.
+- New `concat_struct`, `extract_struct` and `extract_binary` functions for
constructing and extracting complex types.
+- Enhanced protobuf processing and SQL alias parsing, support for the "not in"
operator, and support for SQL reserved keywords as source field names via
backtick-quoted columns.
+
+*Contributed by [@luchunliang](https://github.com/luchunliang) via
[INLONG-12108](https://github.com/apache/inlong/pull/12110),
[INLONG-12111](https://github.com/apache/inlong/pull/12112),
[INLONG-12113](https://github.com/apache/inlong/pull/12114),
[INLONG-12117](https://github.com/apache/inlong/pull/12118),
[INLONG-12125](https://github.com/apache/inlong/pull/12126),
[INLONG-12158](https://github.com/apache/inlong/pull/12159),
[INLONG-12056](https://github.com/apache/inlong/pull/12057)*.
+
+### DataProxy SDK optimization for Go and Python
+The DataProxy SDK is the entry point for business data reporting, so its
robustness and ease of integration directly affect the reporting success rate.
This version improves both the Go and the Python SDK:
+
+- The Go SDK adds a connection timeout and tolerates partial endpoint failures
during client initialization, so a few unavailable DataProxy nodes no longer
block the client from starting.
+- The Go SDK optimizes the worker selection logic, supports a retry mechanism
when a server error occurs, and logs the remote server address on send timeouts
and server errors for faster troubleshooting.
+- The Python SDK builds standard wheels based on PEP-517 and provides a
compile Dockerfile, making the release and installation process reproducible.
+
+*Contributed by [@yfsn666](https://github.com/yfsn666) via
[INLONG-12119](https://github.com/apache/inlong/pull/12122),
[INLONG-12120](https://github.com/apache/inlong/pull/12123),
[INLONG-12121](https://github.com/apache/inlong/pull/12124),
[INLONG-12058](https://github.com/apache/inlong/pull/12059),
[INLONG-12062](https://github.com/apache/inlong/pull/12063),
[INLONG-12016](https://github.com/apache/inlong/pull/12018),
[INLONG-12054](https://github.com/apache/inlong/pull/12055), and by [...]
+
+### Audit route management and concurrency safety optimization
+Following the horizontal scaling capability of Audit Store introduced in
2.3.0, this version continues to improve the usability and stability of the
audit link:
+
+- Optimized audit route management, and audit routing data source management
supports domain names, so that storage clusters can be configured without
hard-coded IP addresses.
+- Optimized the auditing data statistics by day, and the day-level API fills
with zero when there is no data, keeping the trend curves continuous.
+- Resolved thread-safety issues in the Audit SDK under high concurrency,
improving the accuracy of audit data.
+
+*Contributed by [@doleyzi](https://github.com/doleyzi) via
[INLONG-12060](https://github.com/apache/inlong/pull/12061),
[INLONG-12088](https://github.com/apache/inlong/pull/12089),
[INLONG-12067](https://github.com/apache/inlong/pull/12068),
[INLONG-12137](https://github.com/apache/inlong/pull/12138)*.
+
+## Future Plans
+In version 2.4.0, we have systematically strengthened security and enriched
the data processing capabilities of the SDK. Welcome everyone to use it. If you
have more scenarios and requirements, or encounter any problems during use,
please feel free to raise issues and PR. In future versions, the InLong
community will continue to:
+- Support for collecting from more data sources
+- Real-time synchronization supports more data sources and data targets
+- Continuously improve the security and permission management of the whole link
+
+We welcome contributions from developers interested in InLong!
diff --git
a/i18n/zh-CN/docusaurus-plugin-content-blog/2026-08-13-release-2.4.0.md
b/i18n/zh-CN/docusaurus-plugin-content-blog/2026-08-13-release-2.4.0.md
new file mode 100644
index 00000000000..e44afab708f
--- /dev/null
+++ b/i18n/zh-CN/docusaurus-plugin-content-blog/2026-08-13-release-2.4.0.md
@@ -0,0 +1,129 @@
+---
+title: 2.4.0 版本发布
+author: vernedeng
+author_url: https://github.com/vernedeng
+author_image_url: https://avatars.githubusercontent.com/vernedeng
+tags: [Apache InLong, Version]
+---
+
+Apache InLong（应龙） 最近发布了 2.4.0 版本，该版本关闭了 58 个 issue，包含 10 个新特性和 45+
个优化及缺陷修复。该版本重点完成了对数据集成全链路的安全加固，覆盖权限校验、SQL 注入防护、命令执行与文件路径校验；同时扩展了 TransformSDK 对
ProtoBuf 及复杂类型的处理能力，优化了 DataProxy Go SDK 与 Python DataProxy SDK 的发布流程，并完善了
Audit 模块的路由管理与并发安全。Apache InLong 2.4.0 版本中，还完成了大量其它特性。
+<!--truncate-->
+
+
+## 关于 Apache InLong
+
+作为业界首个一站式、全场景海量数据集成框架，Apache InLong（应龙）
提供了自动、安全、可靠和高性能的数据传输能力，方便业务快速构建基于流式的数据分析、建模和应用。目前 InLong
正广泛应用于广告、支付、社交、游戏、人工智能等各个行业领域，服务上千个业务，其中高性能场景数据规模超百万亿条/天，高可靠场景数据规模超十万亿条/天。
+InLong
项目定位的核心关键词是“一站式”、“全场景”和“海量数据”。对于“一站式”，我们希望屏蔽技术细节、提供完整数据集成及配套服务，实现开箱即用；对于“全场景”，我们希望提供全方位的解决方案，覆盖大数据领域常见的数据集成场景；对于“海量数据”，我们希望通过架构上的数据链路分层、全组件可扩展、自带多集群管理等优势，在百万亿条/天的基础上，稳定支持更大规模的数据量。
+## 2.4.0 版本总览
+
+Apache InLong（应龙） 最近发布了 2.4.0 版本，该版本关闭了 58 个 issue，包含 10 个新特性和 45+
个优化及缺陷修复，主要完成了
+
+- 安全能力全面加固，Manager 与 Agent 覆盖权限校验、SQL 注入防护、命令白名单校验及文件路径校验
+- TransformSDK 支持多 Proto 文件、多层嵌套类型的 ProtoBuf 描述文件，并支持 List/Struct/Binary 复杂类型编码
+- DataProxy Go SDK 优化连接初始化、工作协程选择与问题定位能力，Python DataProxy SDK 支持基于 PEP-517
构建标准 wheel 包
+- Audit 优化审计路由管理，并解决 Audit SDK 在高并发下的线程安全问题
+
+同时优化 Apache InLong 运营运维的使用体验。Apache InLong 2.4.0 版本中，还完成了大量其它特性。
+
+### Dashboard 模块
+
+- 补充 Agent 页面缺失的安装方式
+- 优化资源详情页长表单的文本展示，提升可读性
+
+### Manager 模块
+
+- 增强 SQL 注入防护校验，修复 `/api/node/testConnection` 与 `/api/cluster/testConnection`
接口的安全漏洞
+- 新增命令白名单校验，并为 streamsource 删除、datanode 修改、租户角色创建与修改等操作补充权限校验
+- `openapi.auth.enabled` 默认值调整为 `true`，OpenAPI 鉴权默认开启
+- 为 `AuditAlertRuleRequest` 的排序字段以及 `clusterController` 的 node 参数补充参数校验
+- 修复查询 MQ 消息时 LIKE 匹配运算符返回结果不正确的问题，并完善 MQ 消息查询线程池耗尽时的异常处理
+- 完善审计查询 nodeType 映射，避免出现空的审计 ID
+
+### Agent 模块
+
+- 修复文件采集源路径未校验导致的路径穿越风险
+- 使用 `ProcessBuilder` 替换 `/bin/sh -c`，规避命令注入风险
+- 修复 switch 语句中缺失分支的问题
+
+### Sort 模块
+
+- Sort Format 在字段解析出错时支持输出完整的原始行信息，便于问题定位
+- 修复 `DataFlowConfig.version` 为空时 `SortConfigUtil.checkUpdate` 抛出 NPE，导致
SortConfig 重新加载永久卡死的问题
+
+### SDK 模块
+
+- TransformSDK 支持多 Proto 文件、多层嵌套类型的 ProtoBuf 描述文件的解码与转换，并支持解析 map 节点
+- TransformSDK 支持 RowData 中 List、Struct、Binary 类型字段的编码，新增
`concat_struct`/`extract_struct`/`extract_binary` 函数
+- TransformSDK 支持 "not in" 运算符，支持使用 SQL 保留关键字作为源字段名（反引号包裹的列名）
+- 修复 `PbSourceData` 对未设置字段返回 protobuf 默认值而非 null，导致写入 Iceberg/Parquet 的数据不正确的问题
+- DataProxy Go SDK
新增连接超时并在客户端初始化时容忍部分节点不可用，优化工作协程选择逻辑，支持服务端错误重试，并在发送超时及报错时打印远端服务地址
+- Python DataProxy SDK 支持基于 PEP-517 构建标准 wheel 包，新增编译用 Dockerfile，并优化依赖版本要求
+
+### Audit 模块
+
+- 优化审计路由管理，审计路由数据源管理支持域名配置
+- 优化按天维度的审计数据统计，天级接口在无数据时补零
+- 解决 Audit SDK 在高并发场景下的线程安全问题
+- 修复 `PulsarSink` 中静态 `ScheduledExecutorService` 导致的 ClassLoader 泄漏与共享状态污染问题
+- 修复审计 SQL 脚本初始化失败的问题
+
+### Common 模块
+
+- 新增 JSON 配置支持，并修复 jsonconfig 无法正确序列化的问题
+
+### CI 模块
+
+- 修复 GitHub Action 工作流策略违规问题，升级 actions 版本并显式指定 actions 权限
+- 修复单元测试全部执行失败的问题
+
+## 2.4.0 版本主要特性
+
+### 数据集成链路安全能力全面加固
+安全是数据集成框架的核心能力。本版本社区对 Manager 与 Agent 进行了系统性的安全审视与加固，覆盖了管理面最常见的攻击面：
+
+- **权限校验**：删除 streamsource、修改 datanode、创建与修改租户角色时校验操作人权限，避免越权操作资源。
+- **SQL 注入防护**：增强 SQL 注入防护校验，修复 `/api/node/testConnection` 与
`/api/cluster/testConnection` 接口的安全漏洞。
+- **命令执行**：Manager 新增命令白名单校验，Agent 使用 `ProcessBuilder` 替换 `/bin/sh -c`，消除
shell 命令注入风险。
+- **文件路径校验**：Agent 对文件采集源路径进行校验，防止路径穿越。
+- **默认安全**：`openapi.auth.enabled` 默认值调整为 `true`，OpenAPI 鉴权默认开启，无需手动配置。
+
+感谢 [@fuweng11](https://github.com/fuweng11) 对此功能的贡献，具体请参考
[INLONG-12129](https://github.com/apache/inlong/pull/12130)、[INLONG-12133](https://github.com/apache/inlong/pull/12134)、[INLONG-12135](https://github.com/apache/inlong/pull/12136)、[INLONG-12144](https://github.com/apache/inlong/pull/12145)、[INLONG-12156](https://github.com/apache/inlong/pull/12157)、[INLONG-12160](https://github.com/apache/inlong/pull/12161)
；感谢 [@spiritxishi](https://github.com/spiritxishi) 对此功能的贡献，具体请参考 [INLONG-1
[...]
+
+### TransformSDK 支持 ProtoBuf 及复杂类型处理
+InLong Transform 在分发侧适配复杂多样的数据分析场景。在实际业务中，ProtoBuf 描述通常被拆分为多个 Proto
文件并包含多层嵌套结构，而目标存储往往需要复杂类型而非打平的列。本版本大幅扩展了 TransformSDK 的表达能力：
+
+- 支持多 Proto 文件、多层嵌套类型的 ProtoBuf 描述文件的解码与转换，并支持解析 map 节点。
+- 支持 RowData 中 List、Struct、Binary 类型字段的编码，复杂类型可直接写入 Iceberg、Parquet 等目标存储。
+- 新增 `concat_struct`、`extract_struct`、`extract_binary` 函数，用于复杂类型的构造与提取。
+- 增强 protobuf 处理与 SQL 别名解析能力，支持 "not in" 运算符，支持通过反引号使用 SQL 保留关键字作为源字段名。
+
+感谢 [@luchunliang](https://github.com/luchunliang) 对此功能的贡献，具体请参考
[INLONG-12108](https://github.com/apache/inlong/pull/12110)、[INLONG-12111](https://github.com/apache/inlong/pull/12112)、[INLONG-12113](https://github.com/apache/inlong/pull/12114)、[INLONG-12117](https://github.com/apache/inlong/pull/12118)、[INLONG-12125](https://github.com/apache/inlong/pull/12126)、[INLONG-12158](https://github.com/apache/inlong/pull/12159)、[INLONG-12056](https://github.com/apache/inlong/pull/12057)
。
+
+### DataProxy SDK 的 Go 与 Python 优化
+DataProxy SDK 是业务数据上报的入口，其健壮性与接入便利性直接影响上报成功率。本版本同时优化了 Go 与 Python 两个 SDK：
+
+- Go SDK 新增连接超时，并在客户端初始化时容忍部分节点不可用，少量 DataProxy 节点异常不再阻塞客户端启动。
+- Go SDK 优化工作协程选择逻辑，支持服务端错误时的重试机制，并在发送超时与服务端报错时打印远端服务地址，加速问题定位。
+- Python SDK 支持基于 PEP-517 构建标准 wheel 包，并提供编译用 Dockerfile，使发布与安装过程可复现。
+
+感谢 [@yfsn666](https://github.com/yfsn666) 对此功能的贡献，具体请参考
[INLONG-12119](https://github.com/apache/inlong/pull/12122)、[INLONG-12120](https://github.com/apache/inlong/pull/12123)、[INLONG-12121](https://github.com/apache/inlong/pull/12124)、[INLONG-12058](https://github.com/apache/inlong/pull/12059)、[INLONG-12062](https://github.com/apache/inlong/pull/12063)、[INLONG-12016](https://github.com/apache/inlong/pull/12018)、[INLONG-12054](https://github.com/apache/inlong/pull/12055)
；感谢 [@hzqmwne](h [...]
+
+### 审计路由管理与并发安全优化
+在 2.3.0 版本引入 Audit Store 横向扩展能力之后，本版本继续完善审计链路的易用性与稳定性：
+
+- 优化审计路由管理，审计路由数据源管理支持域名配置，存储集群无需硬编码 IP 地址。
+- 优化按天维度的审计数据统计，天级接口在无数据时补零，保证趋势曲线连续。
+- 解决 Audit SDK 在高并发场景下的线程安全问题，提升审计数据的准确性。
+
+感谢 [@doleyzi](https://github.com/doleyzi) 对此功能的贡献，具体请参考
[INLONG-12060](https://github.com/apache/inlong/pull/12061)、[INLONG-12088](https://github.com/apache/inlong/pull/12089)、[INLONG-12067](https://github.com/apache/inlong/pull/12068)、[INLONG-12137](https://github.com/apache/inlong/pull/12138)
。
+
+
+## 未来规划
+
+在 2.4.0 版本中，我们系统性地加固了安全能力，并丰富了 SDK 的数据处理能力。欢迎大家使用，如果有更多场景和需求，或者使用期间遇到的问题，
欢迎大家提 Issue 和 PR。在后续的版本中，InLong 社区将继续：
+
+- 支持更多数据源采集能力
+- 实时同步支持更多数据源、数据目标
+- 持续完善全链路的安全与权限管理能力
+
+我们也期待更多对 InLong 感兴趣的开发者可以参与贡献。
